SkarpChapter 9 of 12
Remediate Without Writing the Admission
Students will be able to communicate remediation progress without making unsupported admissions about liability or causation.
1. Separate remediation from admission
Remediation is not an admission
A company can contain harm, investigate, and improve controls without conceding breach, unreasonable security, or causation.
Use three boxes
Action: what changed. Evidence: what proves it. Conclusion: what remains technically or legally unproved.
2. Build every update in four fields
Four fields
State the historical fact, the prospective improvement, the validation evidence, and the unresolved qualification.
Avoid compressed conclusions
Do not write: "We fixed the failure that caused the incident." A change proves a change, not necessarily historic breach or causation.
3. State the historical position precisely
Say what the records establish
A configuration review can establish that a legacy pathway lacked a requirement. It may not establish who used it or whether it caused the event.
Use bounded language
Describe the dated configuration, the deployed change, and the remaining evidentiary limit. Do not label a control "inadequate" without support.
4. Qualify root cause, do not evade it
Root cause has levels
Separate a confirmed trigger, contributing condition, impact pathway, and unresolved causal question rather than applying one premature label.
Qualify beside the claim
A general reservation does not fix an overstatement. Place the uncertainty directly next to the factual or causal proposition.
5. Report current product remediation without overclaiming
Current CRA context
Since 11 September 2026, Article 14 CRA reporting duties apply. Full application of the CRA's main obligations begins on 11 December 2027.
A patch proves a patch
State the version, release date, mitigations, and monitoring. Do not claim that a patch proves historic compliance or eliminates all customer risk.
6. Make cooperation visible and controlled
Cooperation is evidence-led
Give dates, accountable owners, implementation records, validation results, and a process for correcting changed facts.
Do not promise outcomes
Commit to a deliverable you control, such as a validation report. Avoid assurances that remediation will prevent every future incident.
7. Drafting exercise: repair the regulator update
Rewrite the conclusion
A draft says: "We discovered that monitoring was deficient, fixed the defect, and therefore the incident resulted from our security failure."
Take one minute. Rewrite it using the four fields:
- What does the evidence establish about the historic monitoring configuration?
- What change is complete or scheduled?
- What evidence will validate the change?
- Which conclusions about causation and legal adequacy remain open?
Model direction: retain the supported configuration fact, identify the specific monitoring change, name the test evidence, and state that analysis of the event sequence and legal position remains ongoing.
8. Check understanding
Choose the most defensible regulatory update
Which sentence best communicates remediation without an unsupported admission?
- On 14 September, we deployed the revised alert-routing rule and confirmed through test alerts that the designated response queue received them. Our assessment of the incident's full causal sequence remains ongoing.
- We corrected the monitoring failure that caused the incident and can confirm that this cannot happen again.
- We have taken remedial action, without prejudice to all rights and without any admission of liability.
Show Answer
Answer: A) On 14 September, we deployed the revised alert-routing rule and confirmed through test alerts that the designated response queue received them. Our assessment of the incident's full causal sequence remains ongoing.
Option 1 identifies a dated action, gives validation evidence, and preserves the unresolved causal assessment. Option 2 overstates causation and future assurance. Option 3 supplies no meaningful corrective-action information.
Key Terms
- Cooperation signal
- A verifiable demonstration of constructive engagement, such as timely updates, accountable milestones, and prompt correction of material factual changes.
- Historical position
- A dated statement of the past configuration, process, or event that is supported by identified evidence.
- Prospective improvement
- A change designed to improve the current or future control environment, such as a patch, configuration change, process revision, or additional validation.
- Root-cause qualification
- Language that distinguishes confirmed triggers and contributing conditions from unresolved causal conclusions.
- Corrective action narrative
- A controlled account of what changed, why it was done, and what evidence supports implementation, without automatically conceding breach or causation.